Submission Summary:

• Submission details:
• Submission received: 15 August 2012, 06:38:57
• Processing time: 11 min 6 sec
• Submitted sample:
• File MD5: 0x72E7F2B3A45EB6C24669B32D6F0A9FC8
• File SHA-1: 0xAE78D88EFDC2CA90BC53BE7D023622D85B1FAA0E
• Filesize: 147,968 bytes

• Summary of the findings:

What's been found	Severity Level
Capability to steal information such personal financial data (credit card numbers, online banking login details), user profiles, software registration keys, passwords.
Produces outbound traffic.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\WinRAR

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\WinRAR]
• HWID = 7B 38 44 41 33 35 37 32 35 2D 30 33 45 33 2D 34 30 31 41 2D 38 46 30 36 2D 35 39 38 31 36 42 43 30 30 32 42 44 7D

Other details

• The following Host Names were requested from a host database:
• 192.5.5.241
• 74.53.97.66
• 74.53.97.67
• www.obvjutphaas.nl
• r555.info

• There was registered attempt to establish connection with the remote host. The connection details are:

• The following HTTP URLs were started reading:
• http://www.obvjutphaas.nl/wQ7T.exe
• http://r555.info/41LMMbt5.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 8080: